hijackloki voisiko joku katsoa onko ok?

Discussion in 'Virukset ja haittaohjelmat' started by kapa21, Apr 3, 2006.

  1. kapa21

    kapa21 Member

    Joined:
    Apr 3, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    En tiedä missä ongelma lienee, mutta aloitettan täältä. Kone herjaa varsinkin videotiedostojen aukaisua yrittäessäni (ei aina, mutta usein) virheraporttia jonka jälkeen puhdistaa työpöydän hetkeksi ja esimerkiksi F-secure ei enää näy alapalkissa tämän jälkeen. Löytyikö lokista jotain sellaista mikä selittää koneen käytöstä?

    Kiitos!

    Logfile of HijackThis v1.99.1
    Scan saved at 15:58:37, on 3.4.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\OPOY Tietoturvapalvelu\Common\FSM32.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
    C:\PROGRA~1\OPOYTI~1\backweb\9683872\Program\SERVIC~1.EXE
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Program Files\OPOY Tietoturvapalvelu\backweb\9683872\Program\OPOY-Tietoturva.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\ewido anti-malware\ewidoguard.exe
    C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    C:\Program Files\OPOY Tietoturvapalvelu\backweb\9683872\program\fsbwsys.exe
    C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\FSGK32.EXE
    C:\Program Files\OPOY Tietoturvapalvelu\Common\FSMA32.EXE
    C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\fssm32.exe
    D:\Ohjelmatiedostot\CDBurnerXP\NMSAccess.exe
    C:\Program Files\OPOY Tietoturvapalvelu\Common\FSMB32.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\snmp.exe
    C:\Program Files\OPOY Tietoturvapalvelu\Common\FCH32.EXE
    C:\Program Files\OPOY Tietoturvapalvelu\Common\FAMEH32.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\fsav32.exe
    C:\Program Files\OPOY Tietoturvapalvelu\FWES\Program\fsdfwd.exe
    C:\Program Files\OPOY Tietoturvapalvelu\FSGUI\fsguiexe.exe
    C:\hijack\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.suomi.net:8080
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Ohjelmatiedostot\adobe acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\OPOY Tietoturvapalvelu\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\OPOY Tietoturvapalvelu\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\OPOY Tietoturvapalvelu\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://D:\OHJELM~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - D:\Ohjelmatiedostot\infraview\Ebay\Ebay.htm
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1139746696356
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1140186389057
    O17 - HKLM\System\CCS\Services\Tcpip\..\{15F41DB0-410E-425B-A69C-9BFF39424A1D}: NameServer = 212.50.131.153 213.139.190.3
    O23 - Service: OPOY Tietoturvapalvelu (BackWeb Plug-in - 9683872) - Unknown owner - C:\PROGRA~1\OPOYTI~1\backweb\9683872\Program\SERVIC~1.EXE
    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\OPOY Tietoturvapalvelu\backweb\9683872\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\OPOY Tietoturvapalvelu\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\OPOY Tietoturvapalvelu\Common\FSMA32.EXE
    O23 - Service: fwnet64 (fwnet) - Unknown owner - C:\WINDOWS\fwnet64.exe (file missing)
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: NMSAccess - Unknown owner - D:\Ohjelmatiedostot\CDBurnerXP\NMSAccess.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
     
    kapa21, Apr 3, 2006
    #1
  2. tapiiri

    tapiiri Regular member

    Joined:
    Jun 11, 2005
    Messages:
    1,142
    Likes Received:
    0
    Trophy Points:
    46
    Lataa Ewido, asenna ja päivitä se. Ohjeet ja latauslinkki:

    http://keskustelu.afterdawn.com/thread_view.cfm/269186

    Älä scannaa vielä.

    Näppää käynnistä> suorita> kirjoita ruutuun >

    sc stop fwnet64
    sc delete fwnet64

    Scannaa hijackilla ja ruksaa:

    O23 - Service: fwnet64 (fwnet) - Unknown owner - C:\WINDOWS\fwnet64.exe (file missing)

    Sammuta muut ikkunat ja paina Fix checked.

    Käynnistä kone vikasietotilaan ja poista:

    C:\WINDOWS\fwnet64.exe

    Scannaa Ewidolla Coplete system scan. Tallenna raportti.

    Käynnistä normaalisti ja lähetä uusi hijackthis loki ja Ewidon raportti.
     
    tapiiri, Apr 3, 2006
    #2
  3. kapa21

    kapa21 Member

    Joined:
    Apr 3, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    Ewido:
    ---------------------------------------------------------
    ewido anti-malware - Scan report
    ---------------------------------------------------------

    + Created on: 17:32:16, 3.4.2006
    + Report-Checksum: FE0425CF

    + Scan result:

    :mozilla.30:C:\Documents and Settings\Jani-Matti\Application Data\Mozilla\Firefox\Profiles\w592hw6f.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup
    :mozilla.31:C:\Documents and Settings\Jani-Matti\Application Data\Mozilla\Firefox\Profiles\w592hw6f.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
    :mozilla.32:C:\Documents and Settings\Jani-Matti\Application Data\Mozilla\Firefox\Profiles\w592hw6f.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
    :mozilla.34:C:\Documents and Settings\Jani-Matti\Application Data\Mozilla\Firefox\Profiles\w592hw6f.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
    :mozilla.35:C:\Documents and Settings\Jani-Matti\Application Data\Mozilla\Firefox\Profiles\w592hw6f.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup
    :mozilla.36:C:\Documents and Settings\Jani-Matti\Application Data\Mozilla\Firefox\Profiles\w592hw6f.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup
    :mozilla.54:C:\Documents and Settings\Juho\Application Data\Mozilla\Firefox\Profiles\6m9aav7w.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup
    :mozilla.14:C:\Documents and Settings\Ritva\Application Data\Mozilla\Firefox\Profiles\sxzhkllv.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
    :mozilla.15:C:\Documents and Settings\Ritva\Application Data\Mozilla\Firefox\Profiles\sxzhkllv.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned with backup
    :mozilla.16:C:\Documents and Settings\Ritva\Application Data\Mozilla\Firefox\Profiles\sxzhkllv.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup


    Hijack:
    Logfile of HijackThis v1.99.1
    Scan saved at 17:33:50, on 3.4.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\OPOYTI~1\backweb\9683872\Program\SERVIC~1.EXE
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\ewido anti-malware\ewidoguard.exe
    C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    C:\Program Files\OPOY Tietoturvapalvelu\backweb\9683872\program\fsbwsys.exe
    C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\FSGK32.EXE
    C:\Program Files\OPOY Tietoturvapalvelu\Common\FSMA32.EXE
    C:\Program Files\OPOY Tietoturvapalvelu\Common\FSMB32.EXE
    D:\Ohjelmatiedostot\CDBurnerXP\NMSAccess.exe
    C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\fssm32.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\snmp.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\OPOY Tietoturvapalvelu\Common\FCH32.EXE
    C:\Program Files\OPOY Tietoturvapalvelu\Common\FAMEH32.EXE
    C:\Program Files\OPOY Tietoturvapalvelu\FWES\Program\fsdfwd.exe
    C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\fsav32.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\OPOY Tietoturvapalvelu\Common\FSM32.EXE
    C:\Program Files\OPOY Tietoturvapalvelu\FSGUI\fsguiexe.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\OPOY Tietoturvapalvelu\backweb\9683872\Program\OPOY-Tietoturva.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
    C:\hijack\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.suomi.net:8080
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Ohjelmatiedostot\adobe acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\OPOY Tietoturvapalvelu\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\OPOY Tietoturvapalvelu\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\OPOY Tietoturvapalvelu\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://D:\OHJELM~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - D:\Ohjelmatiedostot\infraview\Ebay\Ebay.htm
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1139746696356
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1140186389057
    O17 - HKLM\System\CCS\Services\Tcpip\..\{15F41DB0-410E-425B-A69C-9BFF39424A1D}: NameServer = 212.50.131.153 213.139.190.3
    O23 - Service: OPOY Tietoturvapalvelu (BackWeb Plug-in - 9683872) - Unknown owner - C:\PROGRA~1\OPOYTI~1\backweb\9683872\Program\SERVIC~1.EXE
    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\OPOY Tietoturvapalvelu\backweb\9683872\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\OPOY Tietoturvapalvelu\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\OPOY Tietoturvapalvelu\Common\FSMA32.EXE
    O23 - Service: fwnet64 (fwnet) - Unknown owner - C:\WINDOWS\fwnet64.exe (file missing)
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: NMSAccess - Unknown owner - D:\Ohjelmatiedostot\CDBurnerXP\NMSAccess.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

     
    kapa21, Apr 3, 2006
    #3
  4. tapiiri

    tapiiri Regular member

    Joined:
    Jun 11, 2005
    Messages:
    1,142
    Likes Received:
    0
    Trophy Points:
    46
    Toi service ei poistunut

    Näppää käynnistä> suorita> kirjoita ruutuun >

    sc stop fwnet
    sc delete fwnet

    bootta kone ja lähetä uusi hijack loki

    Löytyikö toi tiedosto ja poistitko ?
    C:\WINDOWS\fwnet64.exe
     
    tapiiri, Apr 3, 2006
    #4
  5. kapa21

    kapa21 Member

    Joined:
    Apr 3, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    Ei löytynyt. En tietysti sitten älynnyt etsiä mistään muualta. Onko tarvis etsiä ko. tiedostoa jostain muusta hakemistosta ennen toimenpiteitä?
     
    kapa21, Apr 3, 2006
    #5
  6. tapiiri

    tapiiri Regular member

    Joined:
    Jun 11, 2005
    Messages:
    1,142
    Likes Received:
    0
    Trophy Points:
    46
    Ei tarvitse etsiä muualta.

    Laita piilotiedostot näkyviin, ohjeet:

    Piilotiedostot:

    Oma Tietokone >
    - Työkalut >
    - Kansion asetukset >
    - Näytä
    Tiedostot ja kansiot >
    - vieritä alaspäin
    RUKSI pois seuraavasta kohdasta
    - Piilota tunnettujen tiedostotyyppien tunnisteet
    Piilotetut tiedostot ja kansiot
    - RUKSI > Näytä piilotetut tiedostot ja kansiot
    Käytä > OK

    Käynnistä vikasietotilaan ja poista siellä.
     
    tapiiri, Apr 3, 2006
    #6
  7. kapa21

    kapa21 Member

    Joined:
    Apr 3, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    Nonii nyt poistui! Mutta ei sitä sieltä C:Windows kyllä löytynyt edelleenkään.
    Onko vielä jotain tehtävissä?
     
    kapa21, Apr 3, 2006
    #7
  8. kapa21

    kapa21 Member

    Joined:
    Apr 3, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    Ups, unohtui se loki:
    Logfile of HijackThis v1.99.1
    Scan saved at 18:06:37, on 3.4.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\OPOYTI~1\backweb\9683872\Program\SERVIC~1.EXE
    C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\ewido anti-malware\ewidoguard.exe
    C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    C:\Program Files\OPOY Tietoturvapalvelu\backweb\9683872\program\fsbwsys.exe
    C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\FSGK32.EXE
    C:\Program Files\OPOY Tietoturvapalvelu\Common\FSMA32.EXE
    C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\fssm32.exe
    C:\Program Files\OPOY Tietoturvapalvelu\Common\FSMB32.EXE
    D:\Ohjelmatiedostot\CDBurnerXP\NMSAccess.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\snmp.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\OPOY Tietoturvapalvelu\Common\FCH32.EXE
    C:\Program Files\OPOY Tietoturvapalvelu\Common\FAMEH32.EXE
    C:\Program Files\OPOY Tietoturvapalvelu\FWES\Program\fsdfwd.exe
    C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\fsav32.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\OPOY Tietoturvapalvelu\Common\FSM32.EXE
    C:\Program Files\OPOY Tietoturvapalvelu\FSGUI\fsguiexe.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\OPOY Tietoturvapalvelu\backweb\9683872\Program\OPOY-Tietoturva.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
    C:\hijack\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.suomi.net:8080
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Ohjelmatiedostot\adobe acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\OPOY Tietoturvapalvelu\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\OPOY Tietoturvapalvelu\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\OPOY Tietoturvapalvelu\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://D:\OHJELM~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - D:\Ohjelmatiedostot\infraview\Ebay\Ebay.htm
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1139746696356
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1140186389057
    O17 - HKLM\System\CCS\Services\Tcpip\..\{15F41DB0-410E-425B-A69C-9BFF39424A1D}: NameServer = 212.50.131.153 213.139.190.3
    O23 - Service: OPOY Tietoturvapalvelu (BackWeb Plug-in - 9683872) - Unknown owner - C:\PROGRA~1\OPOYTI~1\backweb\9683872\Program\SERVIC~1.EXE
    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\OPOY Tietoturvapalvelu\Anti-Virus\fsgk32st.exe
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\OPOY Tietoturvapalvelu\backweb\9683872\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\OPOY Tietoturvapalvelu\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\OPOY Tietoturvapalvelu\Common\FSMA32.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: NMSAccess - Unknown owner - D:\Ohjelmatiedostot\CDBurnerXP\NMSAccess.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

     
    kapa21, Apr 3, 2006
    #8
  9. tapiiri

    tapiiri Regular member

    Joined:
    Jun 11, 2005
    Messages:
    1,142
    Likes Received:
    0
    Trophy Points:
    46

    sitä ei pakosta olekkaa :

    O23 - Service: fwnet64 (fwnet) - Unknown owner - C:\WINDOWS\fwnet64.exe (file missing)

    Loki on mielestäni kunnossa.
     
    tapiiri, Apr 3, 2006
    #9
  10. kapa21

    kapa21 Member

    Joined:
    Apr 3, 2006
    Messages:
    13
    Likes Received:
    0
    Trophy Points:
    11
    Hyvä!

    Erittäin paljon kiitoksia!!

    -Kapa
     
    kapa21, Apr 3, 2006
    #10
  11. tapiiri

    tapiiri Regular member

    Joined:
    Jun 11, 2005
    Messages:
    1,142
    Likes Received:
    0
    Trophy Points:
    46
    Ole hyvä.
     
    tapiiri, Apr 3, 2006
    #11

Share This Page